deepline 0.3.293 → 0.3.295

package/dist/cli/chunk-5KDKFHZI.js

@@ -0,0 +1,1269 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+var _chunkU3PI7HBMjs = require('./chunk-U3PI7HBM.js');
+
+
+
+var _chunk4NEFYBF7js = require('./chunk-4NEFYBF7.js');
+
+
+var _chunkF35VOIQLjs = require('./chunk-F35VOIQL.js');
+
+
+var _chunkXRK2TZT5js = require('./chunk-XRK2TZT5.js');
+
+// src/cli/commands/update.ts
+var _child_process = require('child_process');
+
+
+
+
+
+
+
+
+
+var _fs = require('fs');
+var _os = require('os');
+
+
+
+
+
+
+
+var _path = require('path');
+
+// src/cli/install-integrity.ts
+var _module = require('module');
+
+
+var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
+  "dist/cli/index.mjs",
+  "dist/index.mjs",
+  "dist/index.d.ts",
+  "dist/plays/bundle-play-file.mjs",
+  "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
+  "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
+  "dist/bundling-sources/shared_libs/product-notifications/contract.ts",
+  "dist/bundling-sources/shared_libs/tool-execution-error.ts"
+];
+var SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES = [
+  "esbuild/package.json",
+  "esbuild/lib/main.js"
+];
+function safeRelativePath(value) {
+  if (typeof value !== "string" || !value || _path.isAbsolute.call(void 0, value)) return false;
+  const segments = value.split(/[\\/]+/);
+  return segments.every(
+    (segment) => Boolean(segment) && segment !== "." && segment !== ".."
+  );
+}
+function resolveContainedPath(root, value) {
+  if (!safeRelativePath(value)) return null;
+  const target = _path.resolve.call(void 0, root, value);
+  const relativeTarget = _path.relative.call(void 0, _path.resolve.call(void 0, root), target);
+  if (!relativeTarget || relativeTarget.startsWith("..") || _path.isAbsolute.call(void 0, relativeTarget)) {
+    return null;
+  }
+  return target;
+}
+function parseJson(path) {
+  return JSON.parse(_fs.readFileSync.call(void 0, path, "utf8"));
+}
+function isFile(path) {
+  try {
+    return _fs.statSync.call(void 0, path).isFile();
+  } catch (e) {
+    return false;
+  }
+}
+function readManifest(packageRoot) {
+  const packageJsonPath = _path.join.call(void 0, packageRoot, "package.json");
+  let packageJson;
+  try {
+    packageJson = parseJson(packageJsonPath);
+  } catch (error) {
+    return {
+      mode: "manifest",
+      invalidReason: `invalid Deepline package metadata: ${error.message}`,
+      missing: _fs.existsSync.call(void 0, packageJsonPath) ? [] : ["deepline/package.json"]
+    };
+  }
+  if (!packageJson || typeof packageJson !== "object" || Array.isArray(packageJson)) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline package metadata: expected an object"
+    };
+  }
+  const metadata = packageJson;
+  if (metadata.deepline !== void 0 && (!metadata.deepline || typeof metadata.deepline !== "object" || Array.isArray(metadata.deepline))) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline package metadata: deepline must be an object"
+    };
+  }
+  const declaration = _optionalChain([metadata, 'access', _ => _.deepline, 'optionalAccess', _2 => _2.installIntegrity]);
+  if (!declaration) {
+    return {
+      mode: "legacy",
+      manifest: {
+        schemaVersion: 1,
+        packageFiles: [...SDK_SIDECAR_CRITICAL_PACKAGE_FILES],
+        dependencyFiles: [...SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES]
+      }
+    };
+  }
+  if (declaration.schemaVersion !== 1 || !safeRelativePath(declaration.manifest)) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline install-integrity declaration"
+    };
+  }
+  const manifestPath = resolveContainedPath(packageRoot, declaration.manifest);
+  if (!manifestPath || !isFile(manifestPath)) {
+    return {
+      mode: "manifest",
+      invalidReason: "declared Deepline install-integrity manifest is missing",
+      missing: [String(declaration.manifest)]
+    };
+  }
+  let raw;
+  try {
+    raw = parseJson(manifestPath);
+  } catch (error) {
+    return {
+      mode: "manifest",
+      invalidReason: `invalid Deepline install-integrity manifest: ${error.message}`
+    };
+  }
+  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !Array.isArray(raw.packageFiles) || !Array.isArray(raw.dependencyFiles)) {
+    return {
+      mode: "manifest",
+      invalidReason: "invalid Deepline install-integrity manifest schema"
+    };
+  }
+  const manifest = raw;
+  if (manifest.packageFiles.length === 0 || manifest.dependencyFiles.length === 0 || !manifest.packageFiles.every(safeRelativePath) || !manifest.dependencyFiles.every(safeRelativePath)) {
+    return {
+      mode: "manifest",
+      invalidReason: "unsafe path in Deepline install-integrity manifest"
+    };
+  }
+  return { mode: "manifest", manifest };
+}
+function inspectSdkSidecarInstall(versionDir) {
+  const nodeModulesRoot = _path.join.call(void 0, versionDir, "node_modules");
+  const packageRoot = _path.join.call(void 0, nodeModulesRoot, "deepline");
+  const manifestResult = readManifest(packageRoot);
+  if ("invalidReason" in manifestResult) {
+    return {
+      ok: false,
+      missing: _nullishCoalesce(manifestResult.missing, () => ( [])),
+      invalidReason: manifestResult.invalidReason,
+      mode: manifestResult.mode
+    };
+  }
+  const missing = [
+    ...manifestResult.manifest.packageFiles.filter((path) => !isFile(_path.join.call(void 0, packageRoot, path))).map((path) => `deepline/${path}`),
+    ...manifestResult.manifest.dependencyFiles.filter((path) => !isFile(_path.join.call(void 0, nodeModulesRoot, path))).map((path) => `node_modules/${path}`)
+  ];
+  return {
+    ok: missing.length === 0,
+    missing,
+    invalidReason: null,
+    mode: manifestResult.mode
+  };
+}
+function probeSdkSidecarEsbuild(versionDir) {
+  try {
+    const requireFromInstall = _module.createRequire.call(void 0, _path.join.call(void 0, versionDir, "package.json"));
+    const esbuild = requireFromInstall("esbuild");
+    if (typeof esbuild.transformSync !== "function") {
+      return "esbuild does not export transformSync";
+    }
+    const result = esbuild.transformSync("const value: number = 1;", {
+      loader: "ts"
+    });
+    if (typeof _optionalChain([result, 'optionalAccess', _3 => _3.code]) !== "string") {
+      return "esbuild transform probe returned no code";
+    }
+    return null;
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+
+// src/cli/update-preferences.ts
+
+
+
+
+
+
+
+
+
+
+var UPDATE_PREFERENCES_SCHEMA_VERSION = 1;
+var CLI_UPDATE_MESSAGES = [
+  {
+    id: "auto-update-default-v1",
+    message: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`."
+  }
+];
+function defaultPreferences() {
+  return {
+    schemaVersion: UPDATE_PREFERENCES_SCHEMA_VERSION,
+    autoUpdateEnabled: true,
+    pinnedVersion: null,
+    acknowledgedMessages: []
+  };
+}
+function unreadablePreferences(path, error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  console.error(
+    `[deepline] Could not read CLI update preferences at ${path}; automatic updates are disabled until the file is repaired or an autoupdate setting is explicitly changed. ${detail}`
+  );
+  return {
+    schemaVersion: UPDATE_PREFERENCES_SCHEMA_VERSION,
+    autoUpdateEnabled: false,
+    pinnedVersion: null,
+    acknowledgedMessages: CLI_UPDATE_MESSAGES.map(({ id }) => id)
+  };
+}
+function cliUpdatePreferencesPath(homeDir = _os.homedir.call(void 0, )) {
+  return _path.join.call(void 0, 
+    homeDir,
+    ".local",
+    "deepline",
+    "sdk-cli",
+    "update-preferences.json"
+  );
+}
+function readCliUpdatePreferences(homeDir = _os.homedir.call(void 0, )) {
+  const path = cliUpdatePreferencesPath(homeDir);
+  if (!_fs.existsSync.call(void 0, path)) return defaultPreferences();
+  try {
+    const parsed = JSON.parse(_fs.readFileSync.call(void 0, path, "utf8"));
+    return {
+      schemaVersion: UPDATE_PREFERENCES_SCHEMA_VERSION,
+      autoUpdateEnabled: typeof parsed.autoUpdateEnabled === "boolean" ? parsed.autoUpdateEnabled : true,
+      pinnedVersion: typeof parsed.pinnedVersion === "string" && parsed.pinnedVersion.trim() ? parsed.pinnedVersion.trim() : null,
+      acknowledgedMessages: Array.isArray(parsed.acknowledgedMessages) ? parsed.acknowledgedMessages.filter(
+        (value) => typeof value === "string"
+      ) : []
+    };
+  } catch (error) {
+    return unreadablePreferences(path, error);
+  }
+}
+function writeCliUpdatePreferences(preferences, homeDir = _os.homedir.call(void 0, )) {
+  const path = cliUpdatePreferencesPath(homeDir);
+  const tempPath = `${path}.${process.pid}.tmp`;
+  _fs.mkdirSync.call(void 0, _path.dirname.call(void 0, path), { recursive: true });
+  try {
+    _fs.writeFileSync.call(void 0, tempPath, `${JSON.stringify(preferences, null, 2)}
+`, {
+      encoding: "utf8",
+      mode: 384
+    });
+    _fs.renameSync.call(void 0, tempPath, path);
+  } finally {
+    _fs.rmSync.call(void 0, tempPath, { force: true });
+  }
+}
+function setCliAutoUpdateEnabled(enabled, homeDir = _os.homedir.call(void 0, )) {
+  const current = readCliUpdatePreferences(homeDir);
+  const next = {
+    ...current,
+    autoUpdateEnabled: enabled,
+    ...enabled ? { pinnedVersion: null } : {}
+  };
+  writeCliUpdatePreferences(next, homeDir);
+  return next;
+}
+function setCliPinnedVersion(version, homeDir = _os.homedir.call(void 0, )) {
+  const next = {
+    ...readCliUpdatePreferences(homeDir),
+    pinnedVersion: version
+  };
+  writeCliUpdatePreferences(next, homeDir);
+  return next;
+}
+function clearCliPinnedVersion(homeDir = _os.homedir.call(void 0, )) {
+  const current = readCliUpdatePreferences(homeDir);
+  if (current.pinnedVersion === null) return current;
+  const next = { ...current, pinnedVersion: null };
+  writeCliUpdatePreferences(next, homeDir);
+  return next;
+}
+function shouldRunCliAutoUpdate(homeDir = _os.homedir.call(void 0, )) {
+  const preferences = readCliUpdatePreferences(homeDir);
+  return preferences.autoUpdateEnabled && preferences.pinnedVersion === null;
+}
+function consumePendingCliUpdateMessages(homeDir = _os.homedir.call(void 0, )) {
+  const preferences = readCliUpdatePreferences(homeDir);
+  const acknowledged = new Set(preferences.acknowledgedMessages);
+  const pending = CLI_UPDATE_MESSAGES.filter(({ id }) => !acknowledged.has(id));
+  if (pending.length === 0) return [];
+  for (const { id } of pending) acknowledged.add(id);
+  try {
+    writeCliUpdatePreferences(
+      { ...preferences, acknowledgedMessages: [...acknowledged] },
+      homeDir
+    );
+  } catch (e2) {
+  }
+  return pending.map(({ message }) => message);
+}
+
+// src/cli/commands/update.ts
+function canAutomaticallyApplyUpdatePlan(plan) {
+  return plan.kind === "python-sidecar" || plan.kind === "npm-global" && Boolean(plan.installPrefix);
+}
+var NPM_SDK_INSTALL_COMMON_FLAGS = [
+  "--no-audit",
+  "--no-fund",
+  "--include=optional"
+];
+var NPM_SDK_SIDECAR_PACKAGE_JSON = `${JSON.stringify(
+  {
+    private: true,
+    allowScripts: {
+      esbuild: true
+    }
+  },
+  null,
+  2
+)}
+`;
+function posixShellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function windowsCmdQuote(value) {
+  return `"${value.replace(/"/g, '""')}"`;
+}
+function shellQuote(value) {
+  if (process.platform === "win32") {
+    return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : windowsCmdQuote(value);
+  }
+  return posixShellQuote(value);
+}
+function buildSourceUpdateCommand(sourceRoot) {
+  const quotedRoot = shellQuote(sourceRoot);
+  const cdCommand = process.platform === "win32" ? `cd /d ${quotedRoot}` : `cd ${quotedRoot}`;
+  return `${cdCommand} && git fetch origin main --tags && git merge --ff-only origin/main`;
+}
+function buildSidecarProjectConfigCommand(versionDir, nodeBin) {
+  const script = [
+    "const fs=require('node:fs');",
+    "const path=require('node:path');",
+    "const dir=process.argv[1];",
+    "fs.mkdirSync(dir,{recursive:true});",
+    `fs.writeFileSync(path.join(dir,'package.json'),${JSON.stringify(NPM_SDK_SIDECAR_PACKAGE_JSON)});`
+  ].join("");
+  return `${shellQuote(nodeBin)} -e ${shellQuote(script)} ${shellQuote(versionDir)}`;
+}
+function sidecarStateDir(input) {
+  const scope = _optionalChain([input, 'access', _4 => _4.env, 'access', _5 => _5.DEEPLINE_CONFIG_SCOPE, 'optionalAccess', _6 => _6.trim, 'call', _7 => _7()]);
+  if (!scope || scope.includes("/") || scope.includes("\\")) {
+    return null;
+  }
+  return _path.join.call(void 0, input.homeDir, ".local", "deepline", scope, "sdk-cli");
+}
+function sidecarRegistryUrl(hostUrl) {
+  let url;
+  try {
+    url = new URL(hostUrl);
+  } catch (e3) {
+    throw new Error(
+      "The Python-managed SDK sidecar is missing a valid Deepline host URL for its npm registry."
+    );
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:" || !url.hostname || url.username || url.password) {
+    throw new Error(
+      "The Python-managed SDK sidecar has an invalid Deepline host URL for its npm registry."
+    );
+  }
+  return new URL("/api/v2/npm/", url).toString();
+}
+function publicNpmFallbackRegistryUrl(hostUrl) {
+  try {
+    return sidecarRegistryUrl(hostUrl);
+  } catch (e4) {
+    return void 0;
+  }
+}
+function readOptionalText(path) {
+  try {
+    return _fs.readFileSync.call(void 0, path, "utf8").trim();
+  } catch (e5) {
+    return "";
+  }
+}
+function resolvePythonSidecarUpdatePlan(options) {
+  const stateDir = sidecarStateDir(options);
+  if (!stateDir) return null;
+  const relativeEntrypoint = _path.relative.call(void 0, 
+    _path.resolve.call(void 0, stateDir),
+    _path.resolve.call(void 0, options.entrypoint)
+  );
+  if (!relativeEntrypoint || relativeEntrypoint.startsWith("..") || _path.isAbsolute.call(void 0, relativeEntrypoint)) {
+    return null;
+  }
+  const installMethod = readOptionalText(_path.join.call(void 0, stateDir, ".install-method"));
+  if (installMethod !== "python-sidecar") return null;
+  const scope = _optionalChain([options, 'access', _8 => _8.env, 'access', _9 => _9.DEEPLINE_CONFIG_SCOPE, 'optionalAccess', _10 => _10.trim, 'call', _11 => _11()]) || "";
+  const hostUrl = _optionalChain([options, 'access', _12 => _12.env, 'access', _13 => _13.DEEPLINE_HOST_URL, 'optionalAccess', _14 => _14.trim, 'call', _15 => _15()]) || "";
+  const nodeBin = readOptionalText(_path.join.call(void 0, stateDir, ".node-bin")) || process.execPath;
+  const sidecarPath = readOptionalText(_path.join.call(void 0, stateDir, ".command-path")) || _path.join.call(void 0, 
+    stateDir,
+    "bin",
+    process.platform === "win32" ? "deepline-sdk.cmd" : "deepline-sdk"
+  );
+  const packageSpec = options.packageSpec || "deepline@latest";
+  const npmCommand = "npm";
+  const registryUrl = sidecarRegistryUrl(hostUrl);
+  const versionDir = _path.join.call(void 0, stateDir, "versions", "<version>");
+  const manualCommand = `${buildSidecarProjectConfigCommand(versionDir, nodeBin)} && ${npmCommand} install --prefix ${shellQuote(versionDir)} --registry ${shellQuote(registryUrl)} ${NPM_SDK_INSTALL_COMMON_FLAGS.map(shellQuote).join(" ")} ${shellQuote(packageSpec)}`;
+  return {
+    kind: "python-sidecar",
+    stateDir,
+    sidecarPath,
+    nodeBin,
+    npmCommand,
+    scope,
+    hostUrl,
+    registryUrl,
+    packageSpec,
+    manualCommand
+  };
+}
+function findRepoBackedSdkRoot(startPath) {
+  let current = _path.resolve.call(void 0, startPath);
+  while (true) {
+    if (_fs.existsSync.call(void 0, _path.join.call(void 0, current, "package.json")) && _fs.existsSync.call(void 0, _path.join.call(void 0, current, "bin", "deepline-dev.ts"))) {
+      const parent2 = _path.dirname.call(void 0, current);
+      return _path.basename.call(void 0, parent2) === "packages" && _path.basename.call(void 0, current) === "sdk" ? _path.dirname.call(void 0, parent2) : parent2;
+    }
+    if (_fs.existsSync.call(void 0, _path.join.call(void 0, current, "sdk", "package.json")) && _fs.existsSync.call(void 0, _path.join.call(void 0, current, "sdk", "bin", "deepline-dev.ts"))) {
+      return current;
+    }
+    const parent = _path.dirname.call(void 0, current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function inferNpmGlobalPrefixFromEntrypoint(entrypoint, env) {
+  const normalized = (() => {
+    try {
+      return _fs.realpathSync.call(void 0, entrypoint);
+    } catch (e6) {
+      return _path.resolve.call(void 0, entrypoint);
+    }
+  })();
+  const parts = normalized.split(/[\\/]+/);
+  const nodeModulesIndex = parts.lastIndexOf("node_modules");
+  if (nodeModulesIndex <= 0 || parts[nodeModulesIndex + 1] !== "deepline") {
+    return null;
+  }
+  const prefixParts = parts.slice(0, nodeModulesIndex);
+  if (prefixParts.at(-1) === "lib") {
+    prefixParts.pop();
+  } else {
+    const directPrefix = prefixParts.join("/").toLowerCase();
+    const knownWindowsPrefixes = [
+      env.npm_config_prefix,
+      env.APPDATA ? _path.join.call(void 0, env.APPDATA, "npm") : void 0
+    ].filter((value) => Boolean(value)).map((value) => _path.resolve.call(void 0, value).replace(/\\/g, "/").toLowerCase());
+    if (!knownWindowsPrefixes.includes(
+      _path.resolve.call(void 0, directPrefix).replace(/\\/g, "/").toLowerCase()
+    )) {
+      return null;
+    }
+  }
+  const prefix = normalized.startsWith("/") && prefixParts[0] !== "" ? `/${prefixParts.join("/")}` : prefixParts.join("/");
+  return prefix || null;
+}
+function normalizedNpmPrefix(value) {
+  const trimmed = _optionalChain([value, 'optionalAccess', _16 => _16.trim, 'call', _17 => _17()]);
+  if (!trimmed) return null;
+  const normalized = (() => {
+    try {
+      return _fs.realpathSync.call(void 0, _path.resolve.call(void 0, trimmed));
+    } catch (e7) {
+      return _path.resolve.call(void 0, trimmed);
+    }
+  })().replace(/\\/g, "/");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function resolveNpmGlobalPrefix(env) {
+  try {
+    const plan = _chunk4NEFYBF7js.resolveShellSpawn.call(void 0, "npm", ["prefix", "-g"]);
+    const result = _child_process.spawnSync.call(void 0, plan.command, plan.args, {
+      encoding: "utf8",
+      env,
+      shell: plan.shell,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    if (result.status !== 0) return null;
+    return String(_nullishCoalesce(result.stdout, () => ( ""))).trim() || null;
+  } catch (e8) {
+    return null;
+  }
+}
+function isHomebrewFormulaEntrypoint(entrypoint) {
+  const normalized = (() => {
+    try {
+      return _fs.realpathSync.call(void 0, entrypoint);
+    } catch (e9) {
+      return _path.resolve.call(void 0, entrypoint);
+    }
+  })();
+  const parts = normalized.split(/[\\/]+/);
+  const cellarIndex = parts.lastIndexOf("Cellar");
+  return cellarIndex >= 0 && parts[cellarIndex + 1] === "deepline" && parts.slice(cellarIndex + 3).includes("libexec");
+}
+function resolveUpdatePlan(options = {}) {
+  const env = _nullishCoalesce(options.env, () => ( process.env));
+  const homeDir = _nullishCoalesce(options.homeDir, () => ( _os.homedir.call(void 0, )));
+  const entrypoint = _nullishCoalesce(options.entrypoint, () => ( (process.argv[1] ? _path.resolve.call(void 0, process.argv[1]) : "")));
+  const sourceRoot = entrypoint ? findRepoBackedSdkRoot(_path.dirname.call(void 0, entrypoint)) : null;
+  if (sourceRoot) {
+    return {
+      kind: "source",
+      repoRoot: sourceRoot,
+      manualCommand: buildSourceUpdateCommand(sourceRoot)
+    };
+  }
+  if (entrypoint && isHomebrewFormulaEntrypoint(entrypoint)) {
+    return {
+      kind: "homebrew",
+      manualCommand: "brew upgrade deepline"
+    };
+  }
+  const sidecarPlan = resolvePythonSidecarUpdatePlan({
+    entrypoint,
+    env,
+    homeDir,
+    packageSpec: options.packageSpec
+  });
+  if (sidecarPlan) return sidecarPlan;
+  const command = "npm";
+  const packageSpec = options.packageSpec || "deepline@latest";
+  const inferredInstallPrefix = entrypoint ? inferNpmGlobalPrefixFromEntrypoint(entrypoint, env) : null;
+  const npmGlobalPrefix = options.npmGlobalPrefix !== void 0 ? options.npmGlobalPrefix : resolveNpmGlobalPrefix(env);
+  const hasVerifiedNpmOwnership = inferredInstallPrefix !== null && normalizedNpmPrefix(inferredInstallPrefix) === normalizedNpmPrefix(npmGlobalPrefix);
+  const installPrefix = options.requireVerifiedNpmOwnership ? hasVerifiedNpmOwnership ? inferredInstallPrefix : null : inferredInstallPrefix;
+  const npmVersion = options.npmVersion === void 0 ? _chunkU3PI7HBMjs.readNpmVersion.call(void 0, env) : options.npmVersion;
+  const npmGlobalInstallFlags = _chunkU3PI7HBMjs.npmSupportsAllowScripts.call(void 0, npmVersion) ? [...NPM_SDK_INSTALL_COMMON_FLAGS, "--allow-scripts=esbuild"] : NPM_SDK_INSTALL_COMMON_FLAGS;
+  const args = installPrefix ? [
+    "install",
+    "-g",
+    "--prefix",
+    installPrefix,
+    ...npmGlobalInstallFlags,
+    packageSpec
+  ] : ["install", "-g", ...npmGlobalInstallFlags, packageSpec];
+  const fallbackRegistryUrl = options.npmFallbackRegistryUrl !== void 0 ? options.npmFallbackRegistryUrl : publicNpmFallbackRegistryUrl(
+    _optionalChain([env, 'access', _18 => _18.DEEPLINE_HOST_URL, 'optionalAccess', _19 => _19.trim, 'call', _20 => _20()]) || _chunkXRK2TZT5js.autoDetectBaseUrl.call(void 0, )
+  );
+  return {
+    kind: "npm-global",
+    command,
+    args,
+    ...installPrefix ? { installPrefix } : {},
+    ...fallbackRegistryUrl ? { fallbackRegistryUrl } : {},
+    manualCommand: `${command} ${args.map(shellQuote).join(" ")}`
+  };
+}
+var AUTO_UPDATE_FAILURE_FILE = ".auto-update-failure.json";
+function autoUpdateFailurePath(plan) {
+  if (plan.kind === "source" || plan.kind === "homebrew") return null;
+  if (plan.kind === "python-sidecar") {
+    return _path.join.call(void 0, plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
+  }
+  return _path.join.call(void 0, 
+    _os.homedir.call(void 0, ),
+    ".local",
+    "deepline",
+    "sdk-cli",
+    AUTO_UPDATE_FAILURE_FILE
+  );
+}
+function autoUpdatePackageSpec(plan) {
+  if (plan.kind === "source" || plan.kind === "homebrew") return "";
+  if (plan.kind === "python-sidecar") return plan.packageSpec;
+  return _nullishCoalesce(plan.args[plan.args.length - 1], () => ( plan.manualCommand));
+}
+function readAutoUpdateFailure(plan) {
+  const path = autoUpdateFailurePath(plan);
+  if (!path) return null;
+  try {
+    const parsed = JSON.parse(
+      _fs.readFileSync.call(void 0, path, "utf8")
+    );
+    if ((parsed.kind === "npm-global" || parsed.kind === "python-sidecar") && typeof parsed.packageSpec === "string" && typeof parsed.failedAt === "string" && typeof parsed.exitCode === "number" && typeof parsed.manualCommand === "string") {
+      return parsed;
+    }
+  } catch (e10) {
+    return null;
+  }
+  return null;
+}
+function writeAutoUpdateFailure(plan, exitCode) {
+  const path = autoUpdateFailurePath(plan);
+  if (!path || plan.kind === "source" || plan.kind === "homebrew") return;
+  const marker = {
+    kind: plan.kind,
+    packageSpec: autoUpdatePackageSpec(plan),
+    failedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    exitCode,
+    manualCommand: plan.manualCommand
+  };
+  try {
+    _fs.mkdirSync.call(void 0, _path.dirname.call(void 0, path), { recursive: true });
+    _fs.writeFileSync.call(void 0, path, `${JSON.stringify(marker, null, 2)}
+`, "utf8");
+  } catch (e11) {
+  }
+}
+function clearAutoUpdateFailure(plan) {
+  const path = autoUpdateFailurePath(plan);
+  if (!path) return;
+  try {
+    _fs.unlinkSync.call(void 0, path);
+  } catch (e12) {
+  }
+}
+function matchingAutoUpdateFailure(plan) {
+  const marker = readAutoUpdateFailure(plan);
+  if (!marker || plan.kind === "source" || plan.kind === "homebrew") {
+    return null;
+  }
+  if (marker.kind !== plan.kind) return null;
+  if (marker.packageSpec !== autoUpdatePackageSpec(plan)) return null;
+  return marker;
+}
+async function runAutomaticUpdatePlan(plan) {
+  const previousFailure = matchingAutoUpdateFailure(plan);
+  if (previousFailure) {
+    process.stderr.write(
+      [
+        "Skipping Deepline SDK/CLI auto-update because this same update already failed on this machine.",
+        `Fix Node/npm native package installation issues, then run: ${previousFailure.manualCommand}`,
+        "Common causes include broken esbuild installs, node-gyp build toolchain errors, npm cache corruption, or registry/network failures.",
+        ""
+      ].join("\n")
+    );
+    return {
+      status: "skipped_previous_failure",
+      exitCode: previousFailure.exitCode || 1,
+      previousFailure
+    };
+  }
+  const exitCode = await runUpdatePlan(plan);
+  return exitCode === 0 ? { status: "updated", exitCode: 0 } : { status: "failed", exitCode };
+}
+function safeVersionSegment(value) {
+  const normalized = value.trim();
+  return /^[0-9A-Za-z._-]+$/.test(normalized) ? normalized : "";
+}
+function entryPathInVersionDir(versionDir) {
+  return _path.join.call(void 0, 
+    versionDir,
+    "node_modules",
+    "deepline",
+    "dist",
+    "cli",
+    "index.mjs"
+  );
+}
+function installedPackageVersion(versionDir) {
+  const packageJsonPath = _path.join.call(void 0, 
+    versionDir,
+    "node_modules",
+    "deepline",
+    "package.json"
+  );
+  try {
+    const parsed = JSON.parse(_fs.readFileSync.call(void 0, packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" ? safeVersionSegment(parsed.version) : "";
+  } catch (e13) {
+    return "";
+  }
+}
+function sidecarStructureFailure(versionDir) {
+  const health = inspectSdkSidecarInstall(versionDir);
+  if (!health.ok) {
+    const details = [
+      ...health.invalidReason ? [health.invalidReason] : [],
+      ...health.missing.length > 0 ? [`missing ${health.missing.join(", ")}`] : []
+    ].join("; ");
+    return details || "required SDK CLI files are missing";
+  }
+  return null;
+}
+function sidecarInstallFailure(versionDir) {
+  const structureFailure = sidecarStructureFailure(versionDir);
+  if (structureFailure) return structureFailure;
+  const esbuildFailure = probeSdkSidecarEsbuild(versionDir);
+  return esbuildFailure ? `esbuild probe failed: ${esbuildFailure}` : null;
+}
+function runCommand(command, args, env = process.env) {
+  return new Promise((resolveResult) => {
+    let output = "";
+    const plan = _chunk4NEFYBF7js.resolveShellSpawn.call(void 0, command, args);
+    const child = _child_process.spawn.call(void 0, plan.command, plan.args, {
+      stdio: ["inherit", "pipe", "pipe"],
+      shell: plan.shell,
+      env
+    });
+    _optionalChain([child, 'access', _21 => _21.stdout, 'optionalAccess', _22 => _22.on, 'call', _23 => _23("data", (chunk) => {
+      output += chunk.toString();
+      process.stderr.write(chunk);
+    })]);
+    _optionalChain([child, 'access', _24 => _24.stderr, 'optionalAccess', _25 => _25.on, 'call', _26 => _26("data", (chunk) => {
+      output += chunk.toString();
+      process.stderr.write(chunk);
+    })]);
+    child.on("error", (error) => {
+      process.stderr.write(`Failed to start ${command}: ${error.message}
+`);
+      resolveResult({ exitCode: 1, output: `${output}
+${error.message}` });
+    });
+    child.on("close", (code) => {
+      resolveResult({ exitCode: _nullishCoalesce(code, () => ( 1)), output });
+    });
+  });
+}
+var DEFAULT_NPM_REGISTRY_URL = "https://registry.npmjs.org/";
+function isRegistryAccessFailure(output, registryUrl) {
+  let registryHost = "";
+  try {
+    registryHost = new URL(registryUrl).hostname;
+  } catch (e14) {
+    return false;
+  }
+  if (!registryHost || !output.toLowerCase().includes(registryHost.toLowerCase())) {
+    return false;
+  }
+  return /\b(?:EAI_AGAIN|ECONNREFUSED|ECONNRESET|ENETUNREACH|ENOTFOUND|EHOSTUNREACH|ETIMEDOUT|E5\d\d)\b|\b5\d\d\b|access denied|blocked|forbidden|network (?:error|timeout)|request .* failed/iu.test(
+    output
+  );
+}
+function withRegistry(args, registryUrl) {
+  return [...args.slice(0, -1), "--registry", registryUrl, _nullishCoalesce(args.at(-1), () => ( ""))];
+}
+function isBinLinkExistsFailure(output) {
+  return /\bEEXIST\b/i.test(output) && /symlink/i.test(output);
+}
+function withForce(args) {
+  if (args.includes("--force")) return args;
+  return [...args.slice(0, -1), "--force", _nullishCoalesce(args.at(-1), () => ( ""))];
+}
+async function runNpmInstallWithRegistryFallback(input) {
+  const primaryArgs = input.primaryRegistryUrl ? withRegistry(input.installArgs, input.primaryRegistryUrl) : input.installArgs;
+  const first = await runCommand(
+    input.npmCommand,
+    primaryArgs,
+    _nullishCoalesce(input.env, () => ( process.env))
+  );
+  if (first.exitCode === 0) {
+    return first.exitCode;
+  }
+  if (input.fallbackRegistryUrl && isRegistryAccessFailure(
+    first.output,
+    _nullishCoalesce(input.primaryRegistryUrl, () => ( DEFAULT_NPM_REGISTRY_URL))
+  )) {
+    process.stderr.write(
+      `Primary npm registry access failed; retrying through Deepline's registry: ${input.fallbackRegistryUrl}
+`
+    );
+    const fallback = await runCommand(
+      input.npmCommand,
+      withRegistry(input.installArgs, input.fallbackRegistryUrl),
+      _nullishCoalesce(input.env, () => ( process.env))
+    );
+    return fallback.exitCode;
+  }
+  if (isBinLinkExistsFailure(first.output)) {
+    process.stderr.write(
+      "npm refused to relink an existing global bin symlink (EEXIST); retrying with --force since this plan only targets this CLI's own install prefix.\n"
+    );
+    const forced = await runCommand(
+      input.npmCommand,
+      withForce(primaryArgs),
+      _nullishCoalesce(input.env, () => ( process.env))
+    );
+    return forced.exitCode;
+  }
+  return first.exitCode;
+}
+function writeSidecarLauncher(input) {
+  _fs.mkdirSync.call(void 0, _path.dirname.call(void 0, input.path), { recursive: true });
+  const packageRoot = _path.dirname.call(void 0, _path.dirname.call(void 0, _path.dirname.call(void 0, input.entryPath)));
+  const versionDir = _path.dirname.call(void 0, _path.dirname.call(void 0, packageRoot));
+  const esbuildProbe = "const {createRequire}=require('node:module');const path=require('node:path');const req=createRequire(path.join(process.argv[1],'package.json'));const result=req('esbuild').transformSync('const value: number = 1;',{loader:'ts'});if(!result||typeof result.code!=='string')process.exit(3);";
+  const criticalPaths = [
+    ...SDK_SIDECAR_CRITICAL_PACKAGE_FILES.map(
+      (path) => _path.join.call(void 0, packageRoot, path)
+    ),
+    ...SDK_SIDECAR_CRITICAL_DEPENDENCY_FILES.map(
+      (path) => _path.join.call(void 0, versionDir, "node_modules", path)
+    )
+  ];
+  if (process.platform === "win32") {
+    _fs.writeFileSync.call(void 0, 
+      input.path,
+      [
+        `@set DEEPLINE_HOST_URL=${input.hostUrl.replace(/\r?\n/g, "")}`,
+        `@set DEEPLINE_CONFIG_SCOPE=${input.scope.replace(/\r?\n/g, "")}`,
+        ...criticalPaths.map(
+          (path) => `@if not exist "${path}" goto repair_sdk`
+        ),
+        `@"${input.nodeBin}" -e "${esbuildProbe}" "${versionDir}" >NUL 2>&1`,
+        "@if errorlevel 1 goto repair_sdk",
+        `@"${input.nodeBin}" "${input.entryPath}" %*`,
+        "@exit /b %ERRORLEVEL%",
+        ":repair_sdk",
+        '@if defined DEEPLINE_REAL_BINARY "%DEEPLINE_REAL_BINARY%" --version=v2 %*',
+        "@if defined DEEPLINE_REAL_BINARY exit /b %ERRORLEVEL%",
+        "@echo Deepline SDK CLI install is incomplete. Run `deepline update` to repair it. 1>&2",
+        "@exit /b 1",
+        ""
+      ].join("\r\n"),
+      "utf8"
+    );
+    return;
+  }
+  _fs.writeFileSync.call(void 0, 
+    input.path,
+    [
+      "#!/usr/bin/env sh",
+      `export DEEPLINE_HOST_URL=${shellQuote(input.hostUrl)}`,
+      `export DEEPLINE_CONFIG_SCOPE=${shellQuote(input.scope)}`,
+      `if ${criticalPaths.map((path) => `[ ! -f ${shellQuote(path)} ]`).join(" || ")}; then`,
+      '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
+      '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
+      "  fi",
+      '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
+      "  exit 1",
+      "fi",
+      `if ! ${shellQuote(input.nodeBin)} -e ${shellQuote(esbuildProbe)} ${shellQuote(versionDir)} >/dev/null 2>&1; then`,
+      '  if [ -n "${DEEPLINE_REAL_BINARY:-}" ] && [ -x "$DEEPLINE_REAL_BINARY" ]; then',
+      '    exec "$DEEPLINE_REAL_BINARY" --version=v2 "$@"',
+      "  fi",
+      '  printf "%s\\n" "Deepline SDK CLI install is incomplete. Run \\`deepline update\\` to repair it." >&2',
+      "  exit 1",
+      "fi",
+      `exec ${shellQuote(input.nodeBin)} ${shellQuote(input.entryPath)} "$@"`,
+      ""
+    ].join("\n"),
+    { encoding: "utf8", mode: 493 }
+  );
+}
+async function runPythonSidecarUpdatePlan(plan) {
+  const versionsDir = _path.join.call(void 0, plan.stateDir, "versions");
+  const tempDir = _path.join.call(void 0, 
+    versionsDir,
+    `.tmp-sdk-update-${process.pid}-${Date.now()}`
+  );
+  _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+  _fs.mkdirSync.call(void 0, tempDir, { recursive: true });
+  _fs.writeFileSync.call(void 0, _path.join.call(void 0, tempDir, "package.json"), NPM_SDK_SIDECAR_PACKAGE_JSON);
+  const env = {
+    ...process.env,
+    PATH: `${_path.dirname.call(void 0, plan.nodeBin)}${process.platform === "win32" ? ";" : ":"}${_nullishCoalesce(process.env.PATH, () => ( ""))}`
+  };
+  const installResult = await runCommand(
+    plan.npmCommand,
+    [
+      "install",
+      "--prefix",
+      tempDir,
+      "--registry",
+      plan.registryUrl,
+      ...NPM_SDK_INSTALL_COMMON_FLAGS,
+      plan.packageSpec
+    ],
+    env
+  );
+  const installExitCode = installResult.exitCode;
+  if (installExitCode !== 0) {
+    _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+    return installExitCode;
+  }
+  const installedVersion = installedPackageVersion(tempDir);
+  if (!installedVersion) {
+    process.stderr.write(
+      "Updated Deepline SDK package did not report a version.\n"
+    );
+    _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+    return 1;
+  }
+  const stagedFailure = sidecarInstallFailure(tempDir);
+  if (stagedFailure) {
+    process.stderr.write(
+      `Updated Deepline SDK package is incomplete: ${stagedFailure}.
+`
+    );
+    _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+    return 1;
+  }
+  const finalDir = _path.join.call(void 0, versionsDir, installedVersion);
+  const finalEntryPath = entryPathInVersionDir(finalDir);
+  const finalFailure = sidecarInstallFailure(finalDir);
+  let backupDir = null;
+  if (!finalFailure) {
+    _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+  } else {
+    let shouldPublishTemp = true;
+    if (_fs.existsSync.call(void 0, finalDir)) {
+      backupDir = _path.join.call(void 0, 
+        versionsDir,
+        `.backup-${installedVersion}-${process.pid}-${Date.now()}`
+      );
+      try {
+        _fs.renameSync.call(void 0, finalDir, backupDir);
+      } catch (error) {
+        const concurrentlyPublishedFailure = sidecarInstallFailure(finalDir);
+        if (!concurrentlyPublishedFailure) {
+          _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+          backupDir = null;
+          shouldPublishTemp = false;
+        } else {
+          _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+          process.stderr.write(
+            `Failed to preserve the incomplete Deepline SDK sidecar before repair: ${error.message}.
+`
+          );
+          return 1;
+        }
+      }
+    }
+    if (shouldPublishTemp) {
+      try {
+        _fs.renameSync.call(void 0, tempDir, finalDir);
+      } catch (error) {
+        _fs.rmSync.call(void 0, tempDir, { recursive: true, force: true });
+        const concurrentlyPublishedFailure = sidecarInstallFailure(finalDir);
+        if (!concurrentlyPublishedFailure) {
+          if (backupDir) _fs.rmSync.call(void 0, backupDir, { recursive: true, force: true });
+          backupDir = null;
+        } else {
+          let restoreFailure = "";
+          if (backupDir && _fs.existsSync.call(void 0, backupDir) && !_fs.existsSync.call(void 0, finalDir)) {
+            try {
+              _fs.renameSync.call(void 0, backupDir, finalDir);
+              backupDir = null;
+            } catch (restoreError) {
+              restoreFailure = `; failed to restore previous install: ${restoreError.message}`;
+            }
+          }
+          process.stderr.write(
+            `Failed to publish Deepline SDK sidecar update: ${error.message}; current install remains incomplete: ${concurrentlyPublishedFailure}${restoreFailure}.
+`
+          );
+          return 1;
+        }
+      }
+    }
+  }
+  const publishedFailure = sidecarStructureFailure(finalDir);
+  if (publishedFailure) {
+    if (backupDir && _fs.existsSync.call(void 0, backupDir)) {
+      _fs.rmSync.call(void 0, finalDir, { recursive: true, force: true });
+      try {
+        _fs.renameSync.call(void 0, backupDir, finalDir);
+        backupDir = null;
+      } catch (e15) {
+      }
+    }
+    process.stderr.write(
+      `Updated Deepline SDK CLI install is incomplete: ${publishedFailure}.
+`
+    );
+    return 1;
+  }
+  if (backupDir) _fs.rmSync.call(void 0, backupDir, { recursive: true, force: true });
+  writeSidecarLauncher({
+    path: plan.sidecarPath,
+    hostUrl: plan.hostUrl,
+    scope: plan.scope,
+    nodeBin: plan.nodeBin,
+    entryPath: finalEntryPath
+  });
+  _fs.writeFileSync.call(void 0, 
+    _path.join.call(void 0, plan.stateDir, ".version"),
+    `${installedVersion}
+`,
+    "utf8"
+  );
+  _fs.writeFileSync.call(void 0, 
+    _path.join.call(void 0, plan.stateDir, ".install-method"),
+    "python-sidecar\n",
+    "utf8"
+  );
+  _fs.writeFileSync.call(void 0, 
+    _path.join.call(void 0, plan.stateDir, ".command-path"),
+    `${plan.sidecarPath}
+`,
+    "utf8"
+  );
+  _fs.writeFileSync.call(void 0, _path.join.call(void 0, plan.stateDir, ".runner"), "node\n", "utf8");
+  _fs.writeFileSync.call(void 0, _path.join.call(void 0, plan.stateDir, ".node-bin"), `${plan.nodeBin}
+`, "utf8");
+  _fs.writeFileSync.call(void 0, 
+    _path.join.call(void 0, plan.stateDir, ".entry-path"),
+    `${finalEntryPath}
+`,
+    "utf8"
+  );
+  return 0;
+}
+async function runUpdatePlan(plan) {
+  let exitCode = 1;
+  if (plan.kind === "npm-global") {
+    exitCode = await runNpmInstallWithRegistryFallback({
+      npmCommand: plan.command,
+      installArgs: plan.args,
+      primaryRegistryUrl: plan.primaryRegistryUrl,
+      fallbackRegistryUrl: plan.fallbackRegistryUrl
+    });
+  } else if (plan.kind === "python-sidecar") {
+    exitCode = await runPythonSidecarUpdatePlan(plan);
+  } else if (plan.kind === "homebrew") {
+    exitCode = 0;
+  }
+  if (exitCode === 0) {
+    clearAutoUpdateFailure(plan);
+  } else {
+    writeAutoUpdateFailure(plan, exitCode);
+  }
+  return exitCode;
+}
+function normalizeBaseUrl(value) {
+  return value.replace(/\/$/, "");
+}
+function normalizePinnedVersion(value) {
+  const normalized = _nullishCoalesce(_optionalChain([value, 'optionalAccess', _27 => _27.trim, 'call', _28 => _28(), 'access', _29 => _29.replace, 'call', _30 => _30(/^v/, "")]), () => ( ""));
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(normalized) ? normalized : null;
+}
+async function publishedVersionSupportsPin(version, fallbackRegistryUrl) {
+  const registryUrls = [
+    "https://registry.npmjs.org/",
+    ...fallbackRegistryUrl ? [fallbackRegistryUrl] : []
+  ];
+  let lastError = null;
+  for (const registryUrl of registryUrls) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 3e3);
+    try {
+      const response = await fetch(
+        new URL(
+          `deepline/${encodeURIComponent(version)}`,
+          registryUrl.endsWith("/") ? registryUrl : `${registryUrl}/`
+        ),
+        {
+          headers: { accept: "application/json" },
+          signal: controller.signal
+        }
+      );
+      if (response.status === 404) return false;
+      if (!response.ok) {
+        lastError = new Error(
+          `${registryUrl} returned HTTP ${response.status}`
+        );
+        continue;
+      }
+      const metadata = await response.json();
+      return _optionalChain([metadata, 'access', _31 => _31.deepline, 'optionalAccess', _32 => _32.updatePreferences]) === 1;
+    } catch (error) {
+      lastError = error instanceof Error ? error : new Error(String(error));
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  throw _nullishCoalesce(lastError, () => ( new Error("No npm registry was available")));
+}
+async function runUpdateCommand(options, dependencies = {}) {
+  const detectBaseUrl = _nullishCoalesce(dependencies.detectBaseUrl, () => ( _chunkXRK2TZT5js.autoDetectBaseUrl));
+  const resolvePlan = _nullishCoalesce(dependencies.resolvePlan, () => ( resolveUpdatePlan));
+  const runPlan = _nullishCoalesce(dependencies.runPlan, () => ( runUpdatePlan));
+  const syncSkills = _nullishCoalesce(dependencies.syncSkillsIfNeeded, () => ( (async () => {
+    const originalWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = (() => true);
+    try {
+      const exitCode = await _chunk4NEFYBF7js.runSkillsCommand.call(void 0, { json: true });
+      if (exitCode !== 0) {
+        throw new Error(
+          `Deepline skills update failed with exit ${exitCode}.`
+        );
+      }
+    } finally {
+      process.stdout.write = originalWrite;
+    }
+  })));
+  const stderr = _nullishCoalesce(dependencies.stderr, () => ( process.stderr));
+  const setPinnedVersion = _nullishCoalesce(dependencies.setPinnedVersion, () => ( setCliPinnedVersion));
+  const clearPinnedVersion = _nullishCoalesce(dependencies.clearPinnedVersion, () => ( clearCliPinnedVersion));
+  const targetSupportsPin = _nullishCoalesce(dependencies.targetSupportsPin, () => ( publishedVersionSupportsPin));
+  const pinnedVersion = options.pin ? normalizePinnedVersion(options.pin) : null;
+  if (options.pin && !pinnedVersion) {
+    stderr.write(
+      `Invalid pinned version "${options.pin}". Use an exact semantic version such as 0.3.0.
+`
+    );
+    return 2;
+  }
+  const plan = resolvePlan(
+    pinnedVersion ? {
+      packageSpec: `deepline@${pinnedVersion}`
+    } : void 0
+  );
+  if (pinnedVersion && !canAutomaticallyApplyUpdatePlan(plan)) {
+    stderr.write(
+      plan.kind === "source" ? "Cannot pin a repo-backed Deepline CLI. Check out the desired SDK revision in the backing repository.\n" : plan.kind === "homebrew" ? "Cannot pin a Homebrew-managed Deepline CLI with npm. Pin the Homebrew formula version instead.\n" : "Cannot pin a project-local or npm-exec Deepline CLI because it does not own a global installation.\n"
+    );
+    return 2;
+  }
+  if (pinnedVersion) {
+    let supportsPin = false;
+    try {
+      const fallbackRegistryUrl = plan.kind === "python-sidecar" ? plan.registryUrl : plan.kind === "npm-global" ? plan.fallbackRegistryUrl : void 0;
+      supportsPin = await targetSupportsPin(pinnedVersion, fallbackRegistryUrl);
+    } catch (error) {
+      stderr.write(
+        `Could not verify whether Deepline CLI ${pinnedVersion} supports version pins: ${error instanceof Error ? error.message : String(error)}
+`
+      );
+      return 5;
+    }
+    if (!supportsPin) {
+      stderr.write(
+        `Cannot pin Deepline CLI ${pinnedVersion}. That published version does not support persisted version pins.
+`
+      );
+      return 2;
+    }
+  }
+  const render = {
+    sections: [
+      {
+        title: "update",
+        lines: plan.kind === "source" ? [
+          "This Deepline CLI is running from SDK source, so it cannot safely update itself like an npm global.",
+          `Update the backing checkout with: ${plan.manualCommand}`
+        ] : plan.kind === "homebrew" ? [
+          "This Deepline CLI was installed by Homebrew, which owns its upgrades.",
+          `Update it with: ${plan.manualCommand}`
+        ] : plan.kind === "python-sidecar" ? [
+          "This Deepline CLI is running from the Python-managed SDK sidecar.",
+          "Updating will refresh that sidecar, not a global npm binary."
+        ] : [`Updating Deepline SDK/CLI with: ${plan.manualCommand}`]
+      }
+    ]
+  };
+  if (options.json && !options.executeWithJson) {
+    _chunkF35VOIQLjs.printCommandEnvelope.call(void 0, { ...plan, render }, { json: true });
+    return 0;
+  }
+  if (options.printCommand) {
+    _chunkF35VOIQLjs.printCommandEnvelope.call(void 0, 
+      {
+        ...plan,
+        render: {
+          sections: [{ title: "update command", lines: [plan.manualCommand] }]
+        }
+      },
+      { json: false, text: `${plan.manualCommand}
+` }
+    );
+    return 0;
+  }
+  if (plan.kind === "source" || plan.kind === "homebrew") {
+    _chunkF35VOIQLjs.printCommandEnvelope.call(void 0, { ...plan, render }, { json: false });
+    return 0;
+  }
+  stderr.write(`Updating Deepline SDK/CLI with: ${plan.manualCommand}
+`);
+  const updateExitCode = await runPlan(plan);
+  if (updateExitCode !== 0) {
+    return updateExitCode;
+  }
+  if (pinnedVersion) {
+    setPinnedVersion(pinnedVersion);
+    stderr.write(
+      `Pinned Deepline CLI to ${pinnedVersion}. Run deepline settings autoupdate on to clear the pin.
+`
+    );
+  } else {
+    clearPinnedVersion();
+  }
+  try {
+    await syncSkills(normalizeBaseUrl(detectBaseUrl()));
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    stderr.write(
+      `Deepline SDK/CLI update completed, but the optional local agent-skills refresh failed. Your CLI update succeeded; this does not affect authentication, data, billing, or the command result.
+Skills refresh detail: ${detail}
+To retry with full installer output, run: deepline skills --json
+`
+    );
+  }
+  if (options.executeWithJson && options.json) {
+    _chunkF35VOIQLjs.printCommandEnvelope.call(void 0, 
+      {
+        ok: true,
+        pinnedVersion
+      },
+      { json: true }
+    );
+  }
+  return 0;
+}
+function registerUpdateCommand(program) {
+  program.command("update").description("Update the Deepline SDK/CLI.").addHelpText(
+    "after",
+    `
+Notes:
+  For the published npm CLI, this runs npm install -g deepline@latest.
+  Automatic updates are enabled by default and run before normal commands.
+  Configure automatic updates with deepline settings autoupdate.
+  For a Homebrew installation, this prints brew upgrade deepline; Homebrew
+  owns formula upgrades and Deepline never runs npm inside its Cellar.
+  For Python-managed SDK sidecars, this refreshes the sidecar that launched
+  the current SDK CLI instead of changing a global npm binary.
+  For repo-backed SDK wrappers such as cli-env sdk-prod or sdk-worktree, this
+  prints the exact git command to update the checkout that provides the CLI.
+
+Examples:
+  deepline update
+  deepline update --print-command
+  deepline update --json
+`
+  ).option("--print-command", "Print the update command without running it").option("--json", "Emit the resolved update plan as JSON").action(async (options) => {
+    process.exitCode = await runUpdateCommand(options);
+  });
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.readCliUpdatePreferences = readCliUpdatePreferences; exports.setCliAutoUpdateEnabled = setCliAutoUpdateEnabled; exports.shouldRunCliAutoUpdate = shouldRunCliAutoUpdate; exports.consumePendingCliUpdateMessages = consumePendingCliUpdateMessages; exports.canAutomaticallyApplyUpdatePlan = canAutomaticallyApplyUpdatePlan; exports.resolveUpdatePlan = resolveUpdatePlan; exports.runAutomaticUpdatePlan = runAutomaticUpdatePlan; exports.runUpdatePlan = runUpdatePlan; exports.publishedVersionSupportsPin = publishedVersionSupportsPin; exports.runUpdateCommand = runUpdateCommand; exports.registerUpdateCommand = registerUpdateCommand;